
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
rocrate-validator
(available as roc-validator
on PyPI) is a Python package to validate RO-Crates
against different profiles, including the base RO-Crate profile and various extensions.
REQUIRED
, RECOMMENDED
, OPTIONAL
)..zip
files) or remotely accessible via HTTP or HTTPS (e.g., http://example.com/ro-crate.zip
).You can install the package using pip
or poetry
. The following instructions assume you have Python 3.8 or later installed.
It’s recommended to create a virtual environment before installing the package to avoid dependency conflicts. You can create one using the following command:
python3 -m venv .venv
Then, activate the virtual environment:
source .venv/bin/activate
.venv\Scripts\activate
.venv\Scripts\Activate.ps1
pip
(from PyPI)You can install the package using pip
:
pip install roc-validator
poetry
(from source)Clone the repository:
git clone https://github.com/crs4/rocrate-validator.git
Navigate to the project directory:
cd rocrate-validator
Ensure you have Poetry installed. If not, follow the instructions here. Then, install the package using poetry
:
poetry install
After installation, use the rocrate-validator
command to validate RO-Crates. You can run this in an active virtual environment (if created in the optional step above) or without a virtual environment if none was created.
Run the validator using the following command:
rocrate-validator validate <path_to_rocrate>
where <path_to_rocrate>
is the path to the RO-Crate you want to validate.
Type rocrate-validator --help
for more information.
poetry
Run the validator using the following command:
poetry run rocrate-validator validate <path_to_rocrate>
where <path_to_rocrate>
is the path to the RO-Crate you want to validate.
Type rocrate-validator --help
for more information.
You can also integrate the package programmatically in your Python code.
Here's an example:
# Import the `services` and `models` module from the rocrate_validator package
from rocrate_validator import services, models
# Create an instance of `ValidationSettings` class to configure the validation
settings = services.ValidationSettings(
# Set the path to the RO-Crate root directory
rocrate_uri='/path/to/ro-crate',
# Set the identifier of the RO-Crate profile to use for validation.
# If not set, the system will attempt to automatically determine the appropriate validation profile.
profile_identifier='ro-crate-1.1',
# Set the requirement level for the validation
requirement_severity=models.Severity.REQUIRED,
)
# Call the validation service with the settings
result = services.validate(settings)
# Check if the validation was successful
if not result.has_issues():
print("RO-Crate is valid!")
else:
print("RO-Crate is invalid!")
# Explore the issues
for issue in result.get_issues():
# Every issue object has a reference to the check that failed, the severity of the issue, and a message describing the issue.
print(f"Detected issue of severity {issue.severity.name} with check \"{issue.check.identifier}\": {issue.message}")
The following is a possible output:
RO-Crate is invalid!
Detected issue of severity REQUIRED with check "ro-crate-1.1:root_entity_exists: The RO-Crate must contain a root entity.
To run the rocrate-validator
tests, use the following command:
poetry run pytest
This project is licensed under the terms of the Apache License 2.0. See the LICENSE file for details.
This work has been partially funded by the following sources:
FAQs
A Python package to validate RO-Crates
We found that roc-validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.